Hey guys and thank you for the quick reply, Much appreciated!

As Richard and Steve mentioned the commit: https://github.com/linux-audit/audit-kernel/commit/1b2263a807ca651f94517b1b22dc5f13e494984d
Fixed this issue.

Any timeframe to when we can get a new version of auditd with that fix?
Or should I count on redhat to release an update to the kernel ?

Any update will be good.

Once again thanks a lot!

‫בתאריך יום ו׳, 6 בינו׳ 2023 ב-22:33 מאת ‪Paul Moore‬‏ <‪paul@paul-moore.com‬‏>:‬
On Thu, Jan 5, 2023 at 2:32 PM Paul Moore <paul@paul-moore.com> wrote:
> On Thu, Jan 5, 2023 at 11:32 AM Steve Grubb <sgrubb@redhat.com> wrote:
> > On Thursday, January 5, 2023 10:41:49 AM EST Paul Moore wrote:
> > > On Thu, Jan 5, 2023 at 8:38 AM Ariel Silver <arielsilver77@gmail.com>
> > wrote:
> > > > I found the following bug:
> > > >
> > > > OS version = Red Hat Enterprise Linux release 8.6 (Ootpa)
> > > > Kernel version = 4.18.0-425.3.1.el8.x86_64
> > > > auditctl version = 3.0.7
> > >
> > > This mailing list is focused on the development and support of
> > > upstream Linux Kernels and Steve's audit userspace, we don't really
> > > provide support for paid distributions.  If you are seeing problems
> > > with the upstream Linux Kernel or tools, please report them here, but
> > > issues with distribution kernels and/or tools should be sent to the
> > > distribution for support/assistance.
> >
> > Paul, we take bug reports and help requests from anyone. Often, distributions
> > are how we first hear of problems.
>
> Steve, re-read what I wrote.
>
> This mailing list is *focused* on upstream work and support, and while
> it does not preclude talking about distro specific bugs, I believe
> there are better avenues for those discussions (e.g. see the RHBZ link
> I provided in my response) as upstream isn't really going to be able
> to provide adequate help for someone experiencing problems with a
> distro kernel which has a number of patches and backports.
>
> If you have a problem with this approach, perhaps we should move
> upstream development to an audit mailing list on vger.kernel.org and
> leave this list for RH specific issues?

Steve, I realize it's only been ~24hrs, but should I assume you are
okay with that (the upstream focused approach)?

--
paul-moore.com